Lip Me20Xc CVE-2026-12503

We need to produce a JSON object based on given instructions. Fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector.

Input: CVE-2026-12503 description, CVSS 4.0 vector, EPSS 0.14% (low), tags, CPEs, SSVC: exploitation none, automatable no, technical impact total. References include Loytec advisory and NVD link. Also "Reported by: NCSC.ch". Affected versions from EUVD up to 8.4.16 on LINX-A64 (maybe specific platform?).

Description: Improper Link Resolution (CWE-59) in /usr/bin/larm_starter in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A64 allows an authenticated larmapp attacker to make /etc/passwd writable by the larmapp group (leading to root privilege escalation) via a symlink attack on /etc/lighttpd/ssl/server.pem. So local authenticated as larmapp user, requires ability to create symlink on that specific file. Attack leads to /etc/passwd becoming group-writable by larmapp group, then can add root account. So privilege escalation from larmapp to root.

CVSS 4.0: AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N. PR:H means high privileges required (likely larmapp is a privileged user/group). However, description says "authenticated larmapp attacker". larmapp could be a low-privileged user? Wait: "larmapp" might be a service account, but the PR:H indicates high privileges needed. So the attacker already has larmapp privileges. Is larmapp high-privileged? Possibly a user with certain permissions. But we can use that vector as basis for assessment. SSVC says none exploitation, not automatable (no), total impact. EPSS low. So overall risk: local, high privileges, not currently exploited, not automatable, but leads to root. For risk assessment we can say it's a significant local privilege escalati